Oracle Cloud Infrastructure Documentation

View and Manage Alert Policies

You can view and perform management tasks with alert policies.

Create and Manage Custom Alert Policies

Expand the capabilities of Data Safe Alerts by creating custom alert policies.

Required Alert Policy Fields

The following table describes the fields you need to fill in when creating an alert policy.

Field Name Description
Policy name Display name of the alert policy you’re creating.
Compartment The compartment where the alert policy will be created. Alert policies can be applied to target databases and target database groups regardless of the compartment. You will associate the alert policy to the target database or target database group in a later step. See Associate and Apply Alert Policies to Target Databases or Target Database Groups for more information.
Severity Critical, High, Medium, or Low. The designated severity level will be visible if an alert is generated.
Rule name Display name of the alert rule. A rule defines the logic that will cause the alert to trigger. An alert policy can have up to five custom rules. You can only create one rule in this workflow, but you can create more in a later step. See Add an Alert Rule to an Existing Alert Policy From Activity Auditing or Manage the Alert Rules of an Existing Alert Policy Manually for more information.
Rule expression SCIM query This shows the System for Cross-Domain Identity Management (SCIM) syntax for filters and defines the logic for your custom alert. You can use Copy rule from an existing alert policy to copy the SCIM syntax from a single existing policy.

Supported Fields for Alert Conditions

The following table describes supported fields for alert conditions.

Field Description
Audit type (auditType) The type of auditing: STANDARD, FINE_GRAINED, XS, DATABASE_VAULT, LABEL_SECURITY, RMAN, DATAPUMP, DIRECT_PATH_API
Client host (clientHostname) The host name of the client application that was the source of the event causing the alert.
Client ID (clientId) The client identifier in each Oracle session.
Client IP (clientIp) The IP address of the client application that was the source of the event causing the alert.
Client program (clientProgram) The application from which the audit event was generated. For example SQL Plus or SQL Developer.
DB user (dbUserName) The name of the database user whose actions were audited.
Error code (errorCode) Oracle Error code generated by the action. Zero indicates the action was successful.
Error message (errorMessage) The detailed message on why the error occurred.
Event (eventName) The name of the event executed by the user on the target database. For example ALTER SEQUENCE, CREATE TRIGGER, or CREATE INDEX.
External user (externalUserId) The user ID of the external user of the audit event.
Location (auditLocation) The location of the audit. Currently the value is audit table.
Object(objectName) Name of the object on the database affected by the action, for example, a table name, file name, or a directory name. Must be in upper case, for example, ALTER_TABLE.
Object owner (objectOwner) The schema name of the object affected by the action.
Object type (objectType) Type of object in the source database affected by the action. For example PL/SQL, SYNONYM, or PACKAGE BODY.
Operation (operation) The name of the action executed by the user on the target database. For example ALTER, CREATE, or DROP.
Operation status (operationStatus) Status of the event: Success or Failure
OS user (osUserName) The name of the operating system user for the database session.
Terminal (osTerminal) The operating system terminal of the user session.
Unified audit policies (auditPolicies) List of audit policies that caused the current audit event.

Create a Custom Alert Policy From the All Activity Audit Report

You can leverage the convenience of audit reports to create custom alert policies. Apply the filters in the All Activity report to narrow down the conditions for alerting and create a new custom alert policy based on the filtered conditions.

  1. Under Data Safe - Database Security, select Activity auditing.

  2. Under Activity auditing, select Audit reports.

  3. Select the All activity report from the list.

  4. Use basic or advanced SCIM filtering to filter the all activity report as desired for the alert policy. Don't create filters that only apply to specific target databases or times as this will cause errors when creating the policy. See the following for help:

  5. From the Actions menu, select Create as alert rule to use the currently applied filters as the conditions for a custom alert.

  6. Select Create an alert policy.

  7. Fill in the required fields. See Required Alert Policy Fields.

  8. Select Create.

Create a Custom Alert Policy Manually

You can use System for Cross-Domain Identity Management (SCIM) syntax to create custom alert policies. Existing alert policies can be used as the basis for a custom alert policy and further customized using SCIM.

  1. Under Data Safe - Database Security, select Alerts.

  2. Under Alerts, select Alert policies.

  3. Select Create alert policy.

  4. Fill in the following required fields:

  5. Select Create.

Add an Alert Rule to an Existing Alert Policy From Activity Auditing

After applying filters to the All activity report in Activity Auditing, you can add a rule to an existing custom alert policy based on the filters.

  1. Under Data Safe - Database Security, select Activity auditing.

  2. Under Activity auditing, select Audit reports.

  3. Select the All activity report from the list.

  4. Use basic or advanced filtering to filter the all activity report as desired for the alert policy.

    Tip: Don't create filters that only apply to specific target databases or times as this will cause errors when creating the policy.

    See Supported Fields for Alert Conditions.

    See Basic Filtering in an Audit Report.

  5. From the Actions menu, select Create as alert rule to use the currently applied filters as the conditions for a custom alert.

  6. Select Create as alert rule to use the currently applied filters as the conditions for an additional rule of an existing alert policy.

    An alert policy can have up to five alert rules. The policy will trigger if any of the rules are met.

  7. Fill in the following required fields.

  8. Select Create.

Manage the Alert Rules of an Existing Alert Policy Manually

After creating a custom alert policy, you can add up to four additional custom alert rules, up to five rules total, to an existing custom alert policy. An alert will be triggered if any of the alert rules are met.

  1. Under Data Safe - Database Security, select Alerts.

  2. Under Alerts, select Alert policies.

  3. Select the Custom alert policies tab.

  4. Select the custom alert policy you'd like to manage the alert rules for.

  5. You can perform the following tasks:

    • On the Alert rules tab, select Add rule to add a new rule. Enter the required fields.

      An alert policy can have up to five alert rules. The policy will trigger if any of the rules are met.

    • In the Alert rules tab, on the row for an existing rule select ... and then Edit to edit it. Enter the required fields.

    • In the Alert rules tab, on the row for an existing rule select ... and then Delete to delete it.

Details for an Oracle Data Safe Alert Policy

Oracle Data Safe provides the following information for each Oracle predefined alert policy:

  • Policy name

  • Severity level of the alert policy; for example, CRITICAL

  • Type of alert policy - Currently, all policies are based on auditing.

  • Oracle Cloud Identifier (OCID) - You can view and copy this OCID.

  • Target databases on which the alert policy is applied

  • Rule expression - For example, the expression for the Profile Changes alert policy is as follows:

    ((operation eq_cs "CREATE" OR operation eq_cs "ALTER" OR operation eq_cs "DROP") AND objectType eq_cs "PROFILE")

View the List of Available Alert Policies

  1. Under Data Safe - Database Security, select Alerts.

  2. Under Alerts, select Alert policies.

    The list of alert policies is displayed. For each policy, you can view its severity level and description.

View Details for an Alert Policy

  1. Under Data Safe - Database Security, select Alerts.

  2. Under Alerts, select Alert policies.

  3. Select either the Oracle predefined alert policies or Custom alert policies tab.

  4. Select the name of the alert policy for which you want to view more information.

    The Alert Policy Details page is displayed.

  5. On the Details tab, view the details for the alert policy.

  6. On the Alert rules tab, view the alert rules associated with the policy.

    You will also see:

    • Rule key: This is a unique identifier that is automatically generated by Data Safe when a rule is created. It is unique across all rules and policies and can be used in filters in other areas of Data Safe.

    • Alerts: This shows the number of alerts that this rule has triggered.

Associate and Apply Alert Policies to Target Databases or Target Database Groups

You can associate and enable alert policies on target databases or target database groups from the Target policy associations page. The Apply policy option on the Target policy associations page and Alert policy page lets you associate and enable alert policies in one step. Currently, you can apply alert policies to a maximum of ten target databases or target database groups at one time.

Also on the Target policy associations page, you can use the Target summary, Target policy associations, and Target group-policy associations tabs to view alert policy information for target databases and target database groups.

To apply alert policies from the Target policy associations page:

  1. Under Data Safe - Database Security, select Alerts.

  2. Under Alerts, select Target policy associations.

    The Target policy associations page opens.

  3. To apply policies to target databases:

    a. Select the Target policy associations tab.

    b. Select Apply policy. The Apply and enable alert policy to target databases panel opens.

    c. Select a compartment, and then, one at a time, select the target databases that you want to apply the alert policies to. To select target databases in different compartments, select Add Row, and repeat this step.

  4. To apply policies to target database groups:

    a. Select the Target group-policy associations tab.

    b. Select Apply policy. The Apply and enable alert policy to target database groups panel opens.

    c. Select a compartment, and then, one at a time, select the target database group that you want to apply the alert policies to. To select target database groups in different compartments, select Add Row, and repeat this step.

  5. Select Apply policy.

    The Apply policy panel opens.

  6. Select the alert policies.

  7. Select Apply policy.

    The alert policies are applied while the panel is open.

  8. Wait until the message Apply “Profile Changes” on <target database names> is displayed and has the status Done.

  9. Select Close.

  10. Refresh the Target policy associations page or Target group-policy associations page to view the new associations.

    The target databases or target database groups have the alert policies enabled by default.

To apply a specific alert policy from the Alert Policy Details page:

  1. Under Data Safe - Database Security, select Alerts.

  2. Under Alerts, select Alert policies.

  3. Select an alert policy from the list.

    The Alert policy page opens.

  4. Select Apply policy.

    The Apply and enable alert policy panel is displayed.

  5. Select Target database to apply the alert policy to target databases, or select Target database group to apply the alert policy to target database groups.

  6. Select the target databases or target database groups for which you want to apply and enable the alert policy.

    • If needed, select the compartment that contains your target databases or target database groups. One at a time from the drop-down list, select target databases or target database groups.
    • To select target databases or target database groups in a different compartment, select Add item. In the new row, select a different compartment, and then select target databases or target database groups.

  7. Select Apply policy.

    The alert policy is applied while the panel is open.

  8. Wait until the apply policy work request is done, and then select Close.

View Target Databases on Which an Alert Policy is Applied

  1. Under Data Safe - Database Security, select Alerts.

  2. Under Alerts, select Alert policies.

  3. Select an alert policy from the list.

    The Alert policy page opens.

  4. Next to Policy applied on target databases, select View list to view the list of target databases on which the alert policy is applied.

    The Target policy associations page opens.

    • The list is automatically filtered by the compartment and alert policy.

    • If the alert policy isn't applied to any target databases, the message No items to display is displayed.

View Alert Policies Associated with a Target Database

  1. Under Data Safe - Database Security, select Alerts.

  2. Under Alerts, select Target policy associations.

  3. On the Target summary tab, locate the target database.

    The number of alert policies applied to the target database is shown in the Alert policies column.

  4. In the row for the target database, select ..., and then select View alert policies.

    An Alert policies panel opens, listing the alert policies associated with the target database.

    • The Target database groups column identifies the target database group names associated with the alert policy.

    • If the Target database groups column shows -, then the alert policy is associated directly with the target database instead of through a target database group.

View Alert Rules for a Target Policy Association or Target Group-Policy Association

  1. Under Data Safe - Database Security, select Alerts.

  2. Under Alerts, select Target policy associations.

    The Target policy associations page opens.

  3. Select the Target policy associations tab or the Target group-policy associations tab.

  4. Select the name of a target database or target database group.

  5. Select the Alert rules tab.

  6. View an Alerts per rule chart, which shows you the number of alerts generated for the rule.

    Note

    Note: The chart is not available for target group-policy associations because alert policies are applied to individual target databases, not to target database groups.

  7. View the Alerts rule table. The table lists each alert rule along with its rule key, description, rule expression, and the number of alerts generated.

  8. To view the entire rule expression:

    a. Select the three dots for a rule in the table, and then select View rule expression.

    b. View the rule expression, and then select Close.

  9. To copy a rule expression, select the three dots for a rule in the table, and then select Copy rule expression.

  10. To view alerts for a rule in the table, select the three dots, and then select View alerts.

    The All alerts report opens and displays a list of alerts generated by the rule during the past week.

Enable or Disable Alert Policies on a Target Database or Target Database Group

  1. Under Data Safe - Database Security, select Alerts.

  2. Under Alerts, select Target policy associations.

    The Target policy associations page opens.

  3. Select the Target policy associations tab or the Target group-policy associations tab.

  4. Use filters to narrow down the targets and/or policies.

  5. In the table, select the check box for the rows that pertain to the target database and alert policy(ies) that you want to enable or disable.

  6. From the Actions menu, select Enable policy or Disable policy.

    An Enable policy or Disable policy dialog box prompts you to confirm.

  7. Select Yes.

Move a Target Policy Association or Target Group-Policy Association

You can move a target policy association or target group-policy association resource to a different compartment.

  1. Under Data Safe - Database Security, select Alerts.

  2. Under Alerts, select Target policy associations.

  3. Select the Target policy associations tab or the Target group-policy associations tab.

  4. Use filters to narrow down the table of associations.

  5. In the table, locate the row that contains the association that you want to move, and then select the name of your target database or target database group.

    The Target policy association or Target group-policy association page opens.

  6. From the Actions menu, select Move resource.

    The Move resource panel opens.

  7. Select a compartment, and then select Move resource.

    The association is immediately moved to the selected compartment.

Delete a Target Policy Association or Target Group-Policy Association

  1. Under Data Safe - Database Security, select Alerts.

  2. Under Alerts, select Target policy associations.

    The Target policy associations page opens.

  3. Select the Target policy associations tab or the Target group-policy associations tab.

  4. Use filters to narrow down the table of associations.

  5. In the row that pertains to your alert policy and target database or target database group, select the target database name or target database group name.

    The Target policy association or Target group-policy association page opens.

  6. From the Actions menu, select Delete.

    The association is deleted.

View Target Database Group Members and Unassociated Targets

For target group-policy associations, you can view the targets in the target database group and the targets that deviate from the group association.

  1. Under Data Safe - Database Security, select Alerts.

  2. Under Alerts, select Target policy associations.

  3. Select the Target group-policy associations tab.

  4. Select the name of a target group-policy association.

    The Target group-policy association page opens.

  5. To view the target databases in the target database group, on the Details tab, next to Target database group members, select View list.

    The Target database group members panel opens and lists the target database members.

    • Select Close to close the panel.

  6. To view target databases in the target database group that do not have the policy applied:

    a. On the Target group policy association page, select the Unassociated target members in group tab.

    b. View the list of target databases that do not have the policy applied. The Reason column provides an explanation.

Related Topics